CVE-2024-0605
Last modified
CVE-2024-0605 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox Focus | < 122.0 |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1855575Issue Tracking, Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2024-03/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1855575Issue Tracking, Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2024-03/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-0605?
How severe is CVE-2024-0605?
How do I fix CVE-2024-0605?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-0598The Gutenberg Blocks by Kadence Blocks – Page Builder Featur…4.8
- CVE-2024-0599A vulnerability was found in Jspxcms 10.2.0. It has been dec…5.4
- CVE-2024-0601A vulnerability was found in ZhongFuCheng3y Austin 1.0. It h…6.5
- CVE-2024-0602The YARPP – Yet Another Related Posts Plugin plugin for Word…4
- CVE-2024-0603A vulnerability classified as critical has been found in Zhi…9.8
- CVE-2024-0604The Best WordPress Gallery Plugin – FooGallery plugin for Wo…4.8
- CVE-2024-0606An attacker could execute unauthorized script on a legitimat…6.1
- CVE-2024-0607A flaw was found in the Netfilter subsystem in the Linux ker…6.6
- CVE-2024-0608The WP ERP | Complete HR solution with recruitment & job lis…6.5
- CVE-2024-0609The WP ERP | Complete HR solution with recruitment & job lis…6.1
- CVE-2024-0610The Piraeus Bank WooCommerce Payment Gateway plugin for Word…9.8
- CVE-2024-0611The Master Slider – Responsive Touch Slider plugin for WordP…4.8
Are you affected by CVE-2024-0605?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST